Date: Sat, 24 May 2025 18:42:16 -0500
From: Nico Williams <nico@cryptonector.com>
To: Chris Gooch <cgooch@bamfunds.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	"pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: [EXT] Re: GSS Auth issue when user member of lots of AD groups
Message-ID: <aDJZWBZZc25xBDX9@ubby>
References: 
 <DS0PR22MB5971A9C8A3F44BCC6293C4DABE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
 <1529314.1747928806@sss.pgh.pa.us>
 <CAOYmi+nZpOu_Yd_dvQQehK78B48MB-TT1Z7Myp1xSQ1uUHHZVQ@mail.gmail.com>
 <1536692.1747933034@sss.pgh.pa.us>
 <DS0PR22MB59712B2BCB379739D97CBA06BE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: 
 <DS0PR22MB59712B2BCB379739D97CBA06BE99A@DS0PR22MB5971.namprd22.prod.outlook.com>
Archived-At: <https://www.postgresql.org/message-id/aDJZWBZZc25xBDX9%40ubby>
Precedence: bulk

On Thu, May 22, 2025 at 05:04:32PM +0000, Chris Gooch wrote:
> It now makes sense to me. I believe the KDC will not allow tokens
> larger than 65535 bytes, so feel it is safe from a GSS perspective.

The KDC protocol over TCP uses 32-bit unsigned PDU lengths in network
byte order, of which the high bit is reserved and must be zero.  ASN.1
supports much larger lengths still.  The protocol easily supports very
large tickets, therefore very large initial security context tokens.

The architecture of having the user's SIDs be included in the user's
service tickets was very useful as an optimization for a long time, but
as the number of SIDs increases this optimization becomes more of an
albatross.

Nico
--